Apple could block 100% of the people using Beeper and throw Hackintosh users into that as a bonus as well.
The reason they’re not doing that is because it could have unintended consequences as some are using someone else’s actual device serial number and those people would be inconvenienced.
It’s nothing that can’t be easily solved, the moment they reach out to support either in person or via phone/chat Apple can immediately verify if they’re using a legitimate Apple device, but even if it boils down to a small percentage of users you still need to prepare for the influx of support requests.
To do this, Apple uses a scoring model to determine if they can access iMessage and historically they’ve been pretty generous by allowing clearly spoofed serials if the Apple ID involved is in good standing and has a positive history, think of it as a credit score. They can tweak the threshold score and probably are testing this out as we speak to find a sweet spot they’re content with.
Apple could also push out an update tomorrow that would end this once and for all by utilizing device attestation and leveraging Secure Enclave, but this would potentially lock out older devices, something they were willing to do when they upgraded the FaceTime protocol a couple of years ago, but they might not want to do that this time around.
Just give it a couple more hardware generations to ensure the largest % of older hardware upgrades. Anything pre-secure enclave chip would need to be in the low digits I'm guessing. Then again, if they are going to block Messages, that might be the incentive to get these older device users to upgrade.
One is supposed to try to find a plausible (follows certain rules) but invalid serial to use for hackintoshing and not use real serials, but of course in practice there’s always some number of careless users…
There's been some talk that blocking this for Beeper will also block this for Hackintosh, but are we just talking about iMessage?
Because I have a hard time believing that (A) Apple can't just block this for iMessage without affecting whatever other system services rely on it and (B) That Apple would care if Hackintoshes lose iMessage.
If those two are true, and assuming Beeper Mini also tries to find plausible but invalid serials to use, then Hackintoshes definitely aren't the reason they aren't blocking based on this.
Apple should easily be able to tell when someone has done this.
Not too long ago, however, they moved to a completely randomized serial format, perhaps partly because of iMessages shenanigans.
Server-side there’s a bunch more information used from the Apple ID.
Together it results in a score and the server then decides if it meets the threshold before deciding to play nice.
Why they allowed it is anyone’s guess, but the leading theory is that they valued not hindering established customers over locking iMessage completely down and perhaps the bad PR that comes with banning someone’s Apple ID over this.
But like you said, there are always people who don’t care about others as long as they have theirs.
There is, so far anyway, no reason to go against this best practice because, even though Apple can instantly detect a bogus serial, their currently used scoring threshold still allows you to use iMessage provided you’ve got a non-fresh Apple ID in good standing.
More proof that Remote Attestation is evil and does not exist to serve the user.
More charitably, perhaps you are saying spam will increase over previous levels. From what I understand, Apple does not have any spam prevention technologies in Messages at all, neither for incoming iMessages, nor for SMS messages-- so the only thing keeping your iMessage conversations free of them is the obscurity of the protocol. Perhaps they should just add anti-spam tech like other texting clients have had for years.
The solution to spam is to petition your government to crack down, or do server side filtering. Banning random phones is like playing whack a mole.
I will give you that remote attestation does help anticheat. However, the current state of anticheat in games is so invasive now that you have to install special kernel drivers, and that kernel has to be on bare metal (no hypervisors allowed). This only happened because a specific genre of fast-twitch first person shooter has a lot of closet cheating going on. But it also gets blindly applied to things like rhythm games that absolutely do not need kernel-level anticheat[1]. So every game gets more invasive because of one hyper-competitive game genre triggering an anticheat arms race.
[0] Or at least, for as long as Web Environment Integrity stays dead
[1] Altering the client isn't even the most common way of cheating rhythm game records. For example, a good chunk of the rules for, say, Pump It Up's online leaderboards is "don't have other players play on your A.M.Pass" and "don't hook up a hand controller onto an online cab". Neither of which would be stopped by an anticheat system (and yes, PIU being an arcade rhythm game, there's shitton of encryption on it).
They can; Apple (and others) have implemented Private Access Tokens (PATs) for this.
https://blog.cloudflare.com/eliminating-captchas-on-iphones-...
And no, web registrations as a must have is an extremely antiquated concept.
You can use device attestation to combat spam by making sure only authentic devices connect to your service.
You can use it to facilitate contact key verification together with a hardware key to ensure contacts know who they’re talking to.
I’ve used it to make sure that introductory promotions are only offered once per device.
On the other end of the spectrum you can use it as a DRM of sorts to make sure ads on your website aren’t blocked.
As far as I know, it's not actually known what model numbers, serial numbers, and disk UUIDs Beeper Mini is sending (and no the POC repository doesn't really tell us)-- if you have a source that talks about this I'd love to read it!
From Beeper's perspective, they now have to figure out why only those logins were blocked and if they need to patch something or not. Apple could be wasting their time and blocked random users out of spite.
Time will tell.
It seems like one side of the debate says "I have experienced this, and the product features seem to encourage this behavior" and the other side says "No one really does this, you just have a few insane friends who happen to use iOS".
Feels like gaslighting when you've experienced this sort of behavior yourself, and not even from tweens who aren't well adjusted to the world, from your middle aged and up friends and family who are bought into that ecosystem.
That said, I've only seen this green vs blue debate reported on in the context of American teens. Even if it is accurate in that group (questionable), that group make up a tiny portion of global smartphone users. Even if the actual group who care are double that, it's still tiny.
As such, it seems unlikely this is such a critical thing that Apple bigwigs are sitting around discussing this group.
It's not simply a MeanGirls experience of not being cool enough. Most Americans don't use or have 3rd party apps like WhatsApp, so most people will fall-back to SMS, which is objectively a much worse experience. I feel like the adult equivalent is getting group dinner with a friend with severe allergies or dietary restrictions. You care about your friend, and you want to invite them, but the effort to include them is high and sometimes you want to try a restaurant you know they can't eat at, so you skip the invite. I'm a vegetarian, and I know my friends skip me outright in the steakhouse dinners.
50% of Americans have an iPhone, and that is even higher for teenagers (almost 90%). That means >50% of people have this superior group functionality built-in (can't beat defaults). That means for teenagers, most of your friends will have iMessages, and most will be able to do effortless group chats, and its a statistical dice-roll to see if someone doesn't have an iPhone. You become "that guy" that causing disruption, and you'll 100% be ignored sporadically.
Again, the issue isn't "I don't wanna see green bubbles", the issue is "I don't want to bother with a third party app for this conversation". Since most people don't regularly use 3rd party messaging apps, there's a coordination issue to be solved picking the app and confirming everyone has it, OR falling back to SMS which is pretty messy. The alternative is to skip one friend and just fill them in later. Sometimes it's easier, it's not an elitist attempt to ostracize.
Apple also relies on the path of least resistance as well, if someone is having a poor experience in a group chat with their iPhone friends...it just becomes "easy" for them to choose an iPhone the next time they change phones.
Look at other companies, Microsoft porting Office etc to MacOS, Google services like maps gmail etc available on the iPhone. It's only Apple that walls their tech in so that it's only on iPhone - they don't care about profit lost to not expanding their reach because they reinforce their own platform.
Your current lived experiences may not be in sync with people in their teens or twenties. This is a well-known phenomenon called "green bubble bullying" that Apple has masterfully orchestrated to make people force other people to buy their phones.
oh wait. i drifted off back to the 90s software cracking days.
After you de-register it the buyer can register it with Apple under their Apple ID.
But Beeper Mini isn't asking users to bring-their-own valid hardware registered Apple hardware ID tied to their Apple ID, they're doing something different/unknown behind the scenes
As far as I know (I could be wrong), in order to log in + auth to Apple's various protocols that are involved to make iMessage work, you need a valid Apple ID and some sort of valid hardware ID.
If you don't have either of those, how would you be talking to Apple's services?
If their POST /login requires email + password + valid registered serial # of device sold that isn't flagged stolen and not shared across 100 accounts... how does Beeper Mini expect to work?
This feels super against terms of services. Taking a paying Apple user's hardware ID and using it for a non-paying user?
Also, I thought you had to tie/pair hardware ID to Apple ID.
I wonder if it might also have anything to do with govt action. I believe a US elected rep recently tweeted in favour of Beeper. Apple cares much more about PR than they'll admit, and server costs for them are negligible.
>Apple previously issued a (somewhat uncommon) statement about Beeper's iMessage access, stating that it "took steps to protect our users by blocking techniques that exploit fake credentials in order to gain access to iMessage." Citing privacy, security, and spam concerns, Apple stated it would "continue to make updates in the future" to protect users. Migicovsky previously denied to Ars that Beeper used "fake credentials" or in any way made iMessages less secure.
Not commenting about the ethics of all this, just wondering why technically Apple can only block ~5% of Beeper Mini users instead of all of them? Could this potentially be tied to the use of an email id as the iMessage handle?